@cubis/foundry 0.3.63 → 0.3.65

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/gemini.json

@@ -0,0 +1,21 @@
+{
+  "platform": "gemini",
+  "displayName": "Gemini CLI",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".gemini",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": {
+    "name": "ui-ux-pro-max",
+    "description": "UI/UX design intelligence with searchable database"
+  },
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Skill"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/kiro.json

@@ -0,0 +1,18 @@
+{
+  "platform": "kiro",
+  "displayName": "Kiro",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".kiro",
+    "skillPath": "steering/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "steering/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": null,
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Workflow"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/opencode.json

@@ -0,0 +1,21 @@
+{
+  "platform": "opencode",
+  "displayName": "OpenCode",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".opencode",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": {
+    "name": "ui-ux-pro-max",
+    "description": "UI/UX design intelligence with searchable database"
+  },
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Skill"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/qoder.json

@@ -0,0 +1,21 @@
+{
+  "platform": "qoder",
+  "displayName": "Qoder",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".qoder",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": {
+    "name": "ui-ux-pro-max",
+    "description": "UI/UX design intelligence with searchable database"
+  },
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Skill"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/roocode.json

@@ -0,0 +1,18 @@
+{
+  "platform": "roocode",
+  "displayName": "Roo Code",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".roo",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": null,
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Workflow"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/trae.json

@@ -0,0 +1,21 @@
+{
+  "platform": "trae",
+  "displayName": "Trae",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".trae",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": {
+    "name": "ui-ux-pro-max",
+    "description": "UI/UX design intelligence with searchable database"
+  },
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Skill"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ui-ux-pro-max/templates/platforms/windsurf.json

@@ -0,0 +1,18 @@
+{
+  "platform": "windsurf",
+  "displayName": "Windsurf",
+  "installType": "full",
+  "folderStructure": {
+    "root": ".windsurf",
+    "skillPath": "skills/ui-ux-pro-max",
+    "filename": "SKILL.md"
+  },
+  "scriptPath": "skills/ui-ux-pro-max/scripts/search.py",
+  "frontmatter": null,
+  "sections": {
+    "quickReference": false
+  },
+  "title": "ui-ux-pro-max",
+  "description": "Comprehensive design guide for web and mobile applications. Contains 67 styles, 96 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 13 technology stacks. Searchable database with priority-based recommendations.",
+  "skillOrWorkflow": "Skill"
+}

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ux-ui-consistency/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: "ux-ui-consistency"
+displayName: "UX/UI Consistency"
+description: "Ensure consistent UX patterns: design system component usage, screen states, error handling, and loading patterns"
+keywords:
+  [
+    "ux",
+    "ui consistency",
+    "design system",
+    "components",
+    "screen states",
+    "error handling",
+    "loading states",
+  ]
+---
+
+# UX/UI Consistency
+
+## Overview
+
+This power ensures consistent user experience across all screens by enforcing design system component usage, proper screen state handling, and standardized error/loading patterns.
+
+## When to Use
+
+- Building new screens or features
+- Reviewing UI code for consistency
+- Implementing loading/error/empty states
+- Refactoring legacy UI to use design system components
+- Fixing UX inconsistencies reported by users
+
+## Quick Reference
+
+### Screen States Pattern
+
+```dart
+// ✅ Always handle all states
+ref.watch(dataProvider).when(
+  data: (data) {
+    if (data.isEmpty) {
+      return EmptyStateWidget(
+        message: 'No items found',
+        action: TextButton(
+          child: Text('Refresh'),
+          onPressed: () => ref.refresh(dataProvider),
+        ),
+      );
+    }
+    return ContentView(data);
+  },
+  loading: () => LoadingWidget(),
+  error: (error, stack) => ErrorWidget(
+    error: error,
+    onRetry: () => ref.refresh(dataProvider),
+  ),
+);
+```
+
+### Design System Component Rules
+
+```dart
+// ❌ Don't use raw Flutter widgets for common patterns
+Text('Hello')
+ElevatedButton(...)
+Container(...)
+
+// ✅ Use your project's design system components
+// Example: OneText.bodyMedium('Hello')
+// Example: OneButton.primary(...)
+// Example: OneContainer(...)
+```
+
+### Consistent Error Handling
+
+```dart
+// ✅ Show user-friendly errors
+try {
+  await submitForm();
+} catch (e) {
+  if (e is NetworkException) {
+    // Show network error via your design system's snackbar
+    showErrorSnackbar(context, 'No internet connection');
+  } else if (e is ValidationException) {
+    showWarningSnackbar(context, e.message);
+  } else {
+    showErrorSnackbar(context, 'Something went wrong');
+  }
+}
+```
+
+## UX Checklist
+
+### Screen States
+- [ ] Loading state (spinner or skeleton)
+- [ ] Error state (error view with retry)
+- [ ] Empty state (empty view with action)
+- [ ] Success state (actual content)
+
+### Interactive Feedback
+- [ ] Button shows loading during async operations
+- [ ] Form validation shows inline errors
+- [ ] Success feedback after mutations (snackbar/dialog)
+- [ ] Confirmation dialogs for destructive actions
+
+### Navigation
+- [ ] Back button behavior is consistent
+- [ ] Deep links work correctly
+- [ ] Navigation guards prevent unauthorized access
+- [ ] Loading states during navigation
+
+### Accessibility
+- [ ] Touch targets are 48x48 minimum
+- [ ] Color contrast meets WCAG AA
+- [ ] Screen reader labels present
+- [ ] Focus order is logical
+
+## References
+
+Load detailed guidance only when needed.
+
+| File | Load when |
+| --- | --- |
+| `steering/one_component_rules.md` | Enforcing design-system component usage and avoiding raw widget drift |
+| `steering/ux_checklist.md` | Running a full UX consistency review across a screen or feature |
+
+## Templates
+
+- `screen_states_widget` - Complete screen state handling template

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ux-ui-consistency/steering/one_component_rules.md

@@ -0,0 +1,15 @@
+# One* component rules
+
+## Allowed in feature UI
+- OneText, OneButton, OneCard, OneInput, OneDialog, OneSnackbar
+- OneEmptyState, OneErrorState, OneProgress, OneRefresh
+- Token usage: OneSpacing, OneRadius, OneTypography, OneColor, OneShadow
+
+## Not allowed in feature UI (unless inside One*)
+- Raw Container/Text/ElevatedButton/Card with custom styles
+- Magic numbers for spacing/radius/typography
+
+## Standard patterns
+- Screen scaffold: OneLayout(title, actions, body)
+- List rows: OneListTile(leading, title, subtitle, trailing)
+- Section cards: OneCard + token padding

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ux-ui-consistency/steering/ux_checklist.md

@@ -0,0 +1,26 @@
+# UX checklist (OneUp HR)
+
+## Screen structure
+- [ ] Clear title + primary action (if any)
+- [ ] Content uses OneLayout / OneCard / OneListTile patterns consistently
+- [ ] No visual jitter when loading transitions
+
+## States
+- [ ] Loading state present
+- [ ] Error state with retry present
+- [ ] Empty state with guidance/action present
+- [ ] Data state present
+
+## Lists
+- [ ] Pull-to-refresh present where appropriate
+- [ ] Pagination has bottom loader and no duplicate requests
+- [ ] Stable keys on items if expansion/selection/stateful rows
+
+## Forms
+- [ ] Field validation and error display is consistent
+- [ ] Submit disabled while submitting
+- [ ] Success feedback (snackbar/dialog) consistent
+
+## Feedback & micro-interactions
+- [ ] Snackbars used sparingly and consistently
+- [ ] Navigation transitions feel consistent

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/ux-ui-consistency/templates/screen_states_widget.md

@@ -0,0 +1,34 @@
+```
+// templates/screen_states_widget.tmpl
+//
+// Standard switch for AsyncValue -> UI states using One* components.
+
+Widget buildAsyncScreen<T>({
+  required AsyncValue<T> state,
+  required Widget Function(T data) dataBuilder,
+  required VoidCallback onRetry,
+  Widget? emptyState,
+}) {
+  return state.when(
+    loading: () => const OneProgress.center(),
+    error: (e, _) => OneErrorState(
+      title: 'Something went wrong',
+      message: e.toString(),
+      actionLabel: 'Retry',
+      onAction: onRetry,
+    ),
+    data: (data) {
+      if (data is Iterable && data.isEmpty) {
+        return emptyState ??
+            OneEmptyState(
+              title: 'No data',
+              subtitle: 'Try changing filters or refresh.',
+              actionLabel: 'Refresh',
+              onAction: onRetry,
+            );
+      }
+      return dataBuilder(data);
+    },
+  );
+}
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/variant-analysis/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: variant-analysis
+description: Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
+---
+
+# Variant Analysis
+
+You are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern.
+
+## When to Use
+
+Use this skill when:
+- A vulnerability has been found and you need to search for similar instances
+- Building or refining CodeQL/Semgrep queries for security patterns
+- Performing systematic code audits after an initial issue discovery
+- Hunting for bug variants across a codebase
+- Analyzing how a single root cause manifests in different code paths
+
+## When NOT to Use
+
+Do NOT use this skill for:
+- Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)
+- General code review without a known pattern to search for
+- Writing fix recommendations (use issue-writer instead)
+- Understanding unfamiliar code (use audit-context-building for deep comprehension first)
+
+## The Five-Step Process
+
+### Step 1: Understand the Original Issue
+
+Before searching, deeply understand the known bug:
+- **What is the root cause?** Not the symptom, but WHY it's vulnerable
+- **What conditions are required?** Control flow, data flow, state
+- **What makes it exploitable?** User control, missing validation, etc.
+
+### Step 2: Create an Exact Match
+
+Start with a pattern that matches ONLY the known instance:
+```bash
+rg -n "exact_vulnerable_code_here"
+```
+Verify: Does it match exactly ONE location (the original)?
+
+### Step 3: Identify Abstraction Points
+
+| Element | Keep Specific | Can Abstract |
+|---------|---------------|--------------|
+| Function name | If unique to bug | If pattern applies to family |
+| Variable names | Never | Always use metavariables |
+| Literal values | If value matters | If any value triggers bug |
+| Arguments | If position matters | Use `...` wildcards |
+
+### Step 4: Iteratively Generalize
+
+**Change ONE element at a time:**
+1. Run the pattern
+2. Review ALL new matches
+3. Classify: true positive or false positive?
+4. If FP rate acceptable, generalize next element
+5. If FP rate too high, revert and try different abstraction
+
+**Stop when false positive rate exceeds ~50%**
+
+### Step 5: Analyze and Triage Results
+
+For each match, document:
+- **Location**: File, line, function
+- **Confidence**: High/Medium/Low
+- **Exploitability**: Reachable? Controllable inputs?
+- **Priority**: Based on impact and exploitability
+
+For deeper strategic guidance, see [METHODOLOGY.md](references/METHODOLOGY.md).
+
+## Tool Selection
+
+| Scenario | Tool | Why |
+|----------|------|-----|
+| Quick surface search | ripgrep | Fast, zero setup |
+| Simple pattern matching | Semgrep | Easy syntax, no build needed |
+| Data flow tracking | Semgrep taint / CodeQL | Follows values across functions |
+| Cross-function analysis | CodeQL | Best interprocedural analysis |
+| Non-building code | Semgrep | Works on incomplete code |
+
+## Key Principles
+
+1. **Root cause first**: Understand WHY before searching for WHERE
+2. **Start specific**: First pattern should match exactly the known bug
+3. **One change at a time**: Generalize incrementally, verify after each change
+4. **Know when to stop**: 50%+ FP rate means you've gone too generic
+5. **Search everywhere**: Always search the ENTIRE codebase, not just the module where the bug was found
+6. **Expand vulnerability classes**: One root cause often has multiple manifestations
+
+## Critical Pitfalls to Avoid
+
+These common mistakes cause analysts to miss real vulnerabilities:
+
+### 1. Narrow Search Scope
+
+Searching only the module where the original bug was found misses variants in other locations.
+
+**Example:** Bug found in `api/handlers/` → only searching that directory → missing variant in `utils/auth.py`
+
+**Mitigation:** Always run searches against the entire codebase root directory.
+
+### 2. Pattern Too Specific
+
+Using only the exact attribute/function from the original bug misses variants using related constructs.
+
+**Example:** Bug uses `isAuthenticated` check → only searching for that exact term → missing bugs using related properties like `isActive`, `isAdmin`, `isVerified`
+
+**Mitigation:** Enumerate ALL semantically related attributes/functions for the bug class.
+
+### 3. Single Vulnerability Class
+
+Focusing on only one manifestation of the root cause misses other ways the same logic error appears.
+
+**Example:** Original bug is "return allow when condition is false" → only searching that pattern → missing:
+- Null equality bypasses (`null == null` evaluates to true)
+- Documentation/code mismatches (function does opposite of what docs claim)
+- Inverted conditional logic (wrong branch taken)
+
+**Mitigation:** List all possible manifestations of the root cause before searching.
+
+### 4. Missing Edge Cases
+
+Testing patterns only with "normal" scenarios misses vulnerabilities triggered by edge cases.
+
+**Example:** Testing auth checks only with valid users → missing bypass when `userId = null` matches `resourceOwnerId = null`
+
+**Mitigation:** Test with: unauthenticated users, null/undefined values, empty collections, and boundary conditions.
+
+## Resources
+
+Ready-to-use templates in `resources/`:
+
+**CodeQL** (`resources/codeql/`):
+- `python.ql`, `javascript.ql`, `java.ql`, `go.ql`, `cpp.ql`
+
+**Semgrep** (`resources/semgrep/`):
+- `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`
+
+**Report**: `resources/variant-report-template.md`

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/variant-analysis/resources/codeql/cpp.ql

@@ -0,0 +1,119 @@
+/**
+ * @name [VARIANT_NAME]
+ * @description Find variants of [ORIGINAL_BUG_ID]
+ * @kind path-problem
+ * @problem.severity error
+ * @tags security variant-analysis
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.new.TaintTracking
+import semmle.code.cpp.security.Security
+import DataFlow::PathGraph
+
+module VariantConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    // Command line arguments
+    exists(Parameter p |
+      p.getName() = "argv" and
+      source.asParameter() = p
+    )
+    or
+    // Standard input
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["gets", "fgets", "scanf", "fscanf", "sscanf", "getline", "getchar", "fgetc"] and
+      source.asExpr() = fc
+    )
+    or
+    // Network input
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["recv", "recvfrom", "recvmsg", "read"] and
+      source.asExpr() = fc
+    )
+    or
+    // Environment variables
+    exists(FunctionCall fc |
+      fc.getTarget().getName() = "getenv" and
+      source.asExpr() = fc
+    )
+    or
+    // File input
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["fread", "fgets"] and
+      source.asExpr() = fc.getArgument(0)
+    )
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    // Command injection
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["system", "popen", "execl", "execlp", "execle", "execv", "execvp", "execvpe"] and
+      sink.asExpr() = fc.getArgument(0)
+    )
+    or
+    // Buffer overflow (unsafe string functions)
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["strcpy", "strcat", "sprintf", "vsprintf", "gets"] and
+      sink.asExpr() = fc.getArgument(1)
+    )
+    or
+    // Format string
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["printf", "fprintf", "sprintf", "snprintf", "syslog"] and
+      sink.asExpr() = fc.getArgument(0)
+    )
+    or
+    // Memory allocation (integer overflow)
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["malloc", "calloc", "realloc", "alloca"] and
+      sink.asExpr() = fc.getArgument(0)
+    )
+    or
+    // Path traversal
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["fopen", "open", "access", "stat", "lstat"] and
+      sink.asExpr() = fc.getArgument(0)
+    )
+    or
+    // SQL (if using embedded SQL or libraries)
+    exists(FunctionCall fc |
+      fc.getTarget().getName().matches("%query%") and
+      sink.asExpr() = fc.getAnArgument()
+    )
+  }
+
+  predicate isBarrier(DataFlow::Node node) {
+    // Input validation
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["strlen", "strnlen", "isalpha", "isdigit", "isalnum"] and
+      node.asExpr() = fc
+    )
+    or
+    // Safe string functions (size-bounded)
+    exists(FunctionCall fc |
+      fc.getTarget().getName() in ["strncpy", "strncat", "snprintf"] and
+      node.asExpr() = fc
+    )
+    or
+    // Sanitization
+    exists(FunctionCall fc |
+      fc.getTarget().getName().matches("%escape%") and
+      node.asExpr() = fc
+    )
+    or
+    // Integer bounds check
+    exists(IfStmt check, RelationalOperation cmp |
+      cmp = check.getCondition() and
+      node.asExpr() = cmp.getAnOperand()
+    )
+  }
+}
+
+module VariantFlow = TaintTracking::Global<VariantConfig>;
+import VariantFlow::PathGraph
+
+from VariantFlow::PathNode source, VariantFlow::PathNode sink
+where VariantFlow::flowPath(source, sink)
+select sink.getNode(), source, sink,
+  "Tainted data from $@ flows to dangerous sink.",
+  source.getNode(), "user input"

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/variant-analysis/resources/codeql/go.ql

@@ -0,0 +1,69 @@
+/**
+ * @name [VARIANT_NAME]
+ * @description Find variants of [ORIGINAL_BUG_ID]
+ * @kind path-problem
+ * @problem.severity error
+ * @tags security variant-analysis
+ */
+
+import go
+import semmle.go.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+module VariantConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    // HTTP request values
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("net/http", "Request", ["FormValue", "PostFormValue"]) and
+      source = c.getResult()
+    )
+    or
+    // URL query params
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("net/url", "Values", "Get") and
+      source = c.getResult()
+    )
+    or
+    // Gin framework
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("github.com/gin-gonic/gin", "Context", ["Query", "Param", "PostForm"]) and
+      source = c.getResult()
+    )
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    // Command injection
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("os/exec", "Command") and
+      sink = c.getArgument(0)
+    )
+    or
+    // SQL injection
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("database/sql", "DB", ["Query", "Exec", "QueryRow"]) and
+      sink = c.getArgument(0)
+    )
+    or
+    // Path traversal
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("os", ["Open", "OpenFile", "ReadFile"]) and
+      sink = c.getArgument(0)
+    )
+  }
+
+  predicate isBarrier(DataFlow::Node node) {
+    exists(DataFlow::CallNode c |
+      c.getTarget().getName() in ["Escape", "Quote", "Clean", "ParseInt", "Atoi"] and
+      node = c.getResult()
+    )
+  }
+}
+
+module VariantFlow = TaintTracking::Global<VariantConfig>;
+import VariantFlow::PathGraph
+
+from VariantFlow::PathNode source, VariantFlow::PathNode sink
+where VariantFlow::flowPath(source, sink)
+select sink.getNode(), source, sink,
+  "Tainted data from $@ flows to dangerous sink.",
+  source.getNode(), "user input"